docker-compose.yml

services:
  db:
    image: postgres:17
    restart: unless-stopped
    volumes:
      - postgres_data:/var/lib/postgresql/data
    environment:
      POSTGRES_DB: props
      POSTGRES_USER: props
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-props_dev_password}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U props"]
      interval: 5s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    restart: unless-stopped
    volumes:
      - redis_data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 5s
      timeout: 3s
      retries: 5

  # Garage secrets generator (runs once to create RPC secrets)
  garage-secrets:
    image: alpine:latest
    volumes:
      - garage_data:/var/lib/garage
    entrypoint: >
      /bin/sh -c "
      if [ ! -f /var/lib/garage/rpc_secret ]; then
        echo 'Generating Garage secrets...'
        apk add --no-cache openssl >/dev/null 2>&1
        openssl rand -hex 32 > /var/lib/garage/rpc_secret
        openssl rand -hex 32 > /var/lib/garage/admin_token
        chmod 644 /var/lib/garage/rpc_secret /var/lib/garage/admin_token
        echo 'Secrets generated'
      else
        echo 'Secrets already exist'
      fi
      "

  # Garage S3-compatible object storage
  garage:
    image: dxflrs/garage:v1.0.1
    restart: unless-stopped
    depends_on:
      garage-secrets:
        condition: service_completed_successfully
    volumes:
      - garage_data:/var/lib/garage
      - ./garage/garage.toml:/etc/garage.toml:ro
    environment:
      GARAGE_ALLOW_WORLD_READABLE_SECRETS: "true"
    healthcheck:
      test: ["CMD", "/garage", "-c", "/etc/garage.toml", "status"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.media.rule=Host(`${DOMAIN}`) && PathPrefix(`/media/`)"
      - "traefik.http.routers.media.entrypoints=websecure"
      - "traefik.http.routers.media.tls.certresolver=letsencrypt"
      - "traefik.http.routers.media.priority=100"
      - "traefik.http.routers.media.middlewares=media-host"
      - "traefik.http.middlewares.media-host.headers.customrequestheaders.Host=assets.web.garage.localhost"
      - "traefik.http.services.media.loadbalancer.server.port=3902"
    networks:
      - default
      - traefik_public

  # Garage initialization (creates bucket and credentials)
  garage-init:
    build:
      context: ./garage
      dockerfile: Dockerfile.init
    depends_on:
      garage:
        condition: service_healthy
    volumes:
      - garage_data:/var/lib/garage
      - ./garage/garage.toml:/etc/garage.toml:ro
    environment:
      BUCKET_NAME: ${S3_BUCKET_NAME:-assets}
      KEY_NAME: ${S3_KEY_NAME:-assets-key}
      CREDENTIALS_FILE: /var/lib/garage/credentials.env
    restart: "no"

  # Dev profile - direct access on port 8003 with Daphne (ASGI)
  web:
    build: .
    restart: unless-stopped
    profiles: ["dev"]
    command: >
      sh -c "
      if [ -f /var/lib/garage/credentials.env ]; then
        echo 'Loading S3 credentials...';
        set -a; . /var/lib/garage/credentials.env; set +a;
      fi &&
      cd /app/src &&
      python manage.py migrate --noinput &&
      python manage.py collectstatic --noinput &&
      daphne -b 0.0.0.0 -p 8000 props.asgi:application
      "
    healthcheck:
      test: ["CMD-SHELL", "python -c 'import urllib.request; urllib.request.urlopen(\"http://localhost:8000/health/\")'"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - .:/app
      - static_volume:/app/src/staticfiles
      - garage_data:/var/lib/garage:ro
    ports:
      - "8003:8000"
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      garage-init:
        condition: service_completed_successfully
    env_file: .env
    environment:
      DATABASE_URL: postgres://props:${POSTGRES_PASSWORD:-props_dev_password}@db:5432/props
      USE_S3: "True"
      AWS_S3_ENDPOINT_URL: http://garage:3900

  # Celery worker (dev - builds from source with volume mount)
  celery-worker:
    build: .
    restart: unless-stopped
    profiles: ["dev"]
    extra_hosts:
      - "host.docker.internal:host-gateway"
    command: >
      sh -c "
      if [ -f /var/lib/garage/credentials.env ]; then
        set -a; . /var/lib/garage/credentials.env; set +a;
      fi &&
      cd /app/src &&
      celery -A props worker --loglevel=info --concurrency=1 --prefetch-multiplier=1
      "
    healthcheck:
      test: ["CMD-SHELL", "cd /app/src && celery -A props inspect ping --timeout 5"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - .:/app
      - garage_data:/var/lib/garage:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      garage-init:
        condition: service_completed_successfully
    env_file: .env
    environment:
      DATABASE_URL: postgres://props:${POSTGRES_PASSWORD:-props_dev_password}@db:5432/props
      USE_S3: "True"
      AWS_S3_ENDPOINT_URL: http://garage:3900

  # Celery worker (prod - uses pre-built GHCR image)
  celery-worker-prod:
    image: ghcr.io/realworldtech/props:${PROPS_VERSION:-latest}
    restart: unless-stopped
    profiles: ["prod"]
    extra_hosts:
      - "host.docker.internal:host-gateway"
    command: >
      sh -c "
      if [ -f /var/lib/garage/credentials.env ]; then
        set -a; . /var/lib/garage/credentials.env; set +a;
      fi &&
      cd /app/src &&
      celery -A props worker --loglevel=info --concurrency=1 --prefetch-multiplier=1
      "
    healthcheck:
      test: ["CMD-SHELL", "cd /app/src && celery -A props inspect ping --timeout 5"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s
    volumes:
      - garage_data:/var/lib/garage:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      garage-init:
        condition: service_completed_successfully
    env_file: .env
    environment:
      DATABASE_URL: postgres://props:${POSTGRES_PASSWORD}@db:5432/props
      USE_S3: "True"
      AWS_S3_ENDPOINT_URL: http://garage:3900

  # Celery beat scheduler (dev - builds from source with volume mount)
  celery-beat:
    build: .
    restart: unless-stopped
    profiles: ["dev"]
    command: >
      sh -c "
      if [ -f /var/lib/garage/credentials.env ]; then
        set -a; . /var/lib/garage/credentials.env; set +a;
      fi &&
      cd /app/src &&
      celery -A props beat --loglevel=info --scheduler django_celery_beat.schedulers:DatabaseScheduler
      "
    volumes:
      - .:/app
      - garage_data:/var/lib/garage:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    env_file: .env
    environment:
      DATABASE_URL: postgres://props:${POSTGRES_PASSWORD:-props_dev_password}@db:5432/props

  # Celery beat scheduler (prod - uses pre-built GHCR image)
  celery-beat-prod:
    image: ghcr.io/realworldtech/props:${PROPS_VERSION:-latest}
    restart: unless-stopped
    profiles: ["prod"]
    command: >
      sh -c "
      if [ -f /var/lib/garage/credentials.env ]; then
        set -a; . /var/lib/garage/credentials.env; set +a;
      fi &&
      cd /app/src &&
      celery -A props beat --loglevel=info --scheduler django_celery_beat.schedulers:DatabaseScheduler
      "
    volumes:
      - garage_data:/var/lib/garage:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
    env_file: .env
    environment:
      DATABASE_URL: postgres://props:${POSTGRES_PASSWORD}@db:5432/props

  # Prod init - runs migrations and collectstatic once before web starts
  web-init:
    image: ghcr.io/realworldtech/props:${PROPS_VERSION:-latest}
    profiles: ["prod"]
    command: >
      sh -c "
      if [ -f /var/lib/garage/credentials.env ]; then
        set -a; . /var/lib/garage/credentials.env; set +a;
      fi &&
      cd /app/src &&
      rm -f /app/src/staticfiles/staticfiles.json &&
      python manage.py migrate --noinput &&
      python manage.py collectstatic --noinput --clear
      "
    volumes:
      - static_volume:/app/src/staticfiles
      - garage_data:/var/lib/garage:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      garage-init:
        condition: service_completed_successfully
    env_file: .env
    environment:
      DATABASE_URL: postgres://props:${POSTGRES_PASSWORD}@db:5432/props
      USE_S3: "True"
      AWS_S3_ENDPOINT_URL: http://garage:3900
    restart: "no"

  # Prod HTTP — Gunicorn (sync views, static files via WhiteNoise)
  web-prod:
    image: ghcr.io/realworldtech/props:${PROPS_VERSION:-latest}
    restart: unless-stopped
    profiles: ["prod"]
    deploy:
      replicas: 2
      update_config:
        parallelism: 1
        delay: 15s
        order: start-first
    extra_hosts:
      - "host.docker.internal:host-gateway"
    command: >
      sh -c "
      if [ -f /var/lib/garage/credentials.env ]; then
        set -a; . /var/lib/garage/credentials.env; set +a;
      fi &&
      cd /app/src &&
      gunicorn --bind 0.0.0.0:8000 --workers 2 --threads 2 props.wsgi:application
      "
    healthcheck:
      test: ["CMD-SHELL", "python -c 'import urllib.request; urllib.request.urlopen(\"http://localhost:8000/health/\")'"]
      interval: 5s
      timeout: 5s
      retries: 3
      start_period: 60s
    volumes:
      - static_volume:/app/src/staticfiles
      - garage_data:/var/lib/garage:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      garage-init:
        condition: service_completed_successfully
      web-init:
        condition: service_completed_successfully
    env_file: .env
    environment:
      DATABASE_URL: postgres://props:${POSTGRES_PASSWORD}@db:5432/props
      USE_S3: "True"
      AWS_S3_ENDPOINT_URL: http://garage:3900
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.props.rule=Host(`${DOMAIN}`)"
      - "traefik.http.routers.props.entrypoints=websecure"
      - "traefik.http.routers.props.tls.certresolver=letsencrypt"
      - "traefik.http.services.props.loadbalancer.server.port=8000"
    networks:
      - default
      - traefik_public

  # Prod WebSocket — Daphne (ASGI, handles /ws/ paths only)
  ws-prod:
    image: ghcr.io/realworldtech/props:${PROPS_VERSION:-latest}
    restart: unless-stopped
    profiles: ["prod"]
    extra_hosts:
      - "host.docker.internal:host-gateway"
    command: >
      sh -c "
      if [ -f /var/lib/garage/credentials.env ]; then
        set -a; . /var/lib/garage/credentials.env; set +a;
      fi &&
      cd /app/src &&
      daphne -b 0.0.0.0 -p 8000 props.asgi:application
      "
    healthcheck:
      test: ["CMD-SHELL", "python -c 'import urllib.request; urllib.request.urlopen(\"http://localhost:8000/health/\")'"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 30s
    volumes:
      - garage_data:/var/lib/garage:ro
    depends_on:
      db:
        condition: service_healthy
      redis:
        condition: service_healthy
      garage-init:
        condition: service_completed_successfully
      web-init:
        condition: service_completed_successfully
    env_file: .env
    environment:
      DATABASE_URL: postgres://props:${POSTGRES_PASSWORD}@db:5432/props
      USE_S3: "True"
      AWS_S3_ENDPOINT_URL: http://garage:3900
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.props-ws.rule=Host(`${DOMAIN}`) && PathPrefix(`/ws/`)"
      - "traefik.http.routers.props-ws.entrypoints=websecure"
      - "traefik.http.routers.props-ws.tls.certresolver=letsencrypt"
      - "traefik.http.routers.props-ws.priority=200"
      - "traefik.http.services.props-ws.loadbalancer.server.port=8000"
    networks:
      - default
      - traefik_public

  # Traefik reverse proxy - prod only
  traefik:
    image: traefik:v3.6
    restart: unless-stopped
    profiles: ["prod"]
    ports:
      - "80:80"
      - "443:443"
    environment:
      TRAEFIK_CERTIFICATESRESOLVERS_LETSENCRYPT_ACME_EMAIL: ${ACME_EMAIL}
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./traefik/traefik.yml:/etc/traefik/traefik.yml:ro
      - traefik_certs:/letsencrypt
    networks:
      - default
      - traefik_public

networks:
  traefik_public:
    external: true

volumes:
  postgres_data:
  redis_data:
  static_volume:
  garage_data:
  traefik_certs: